azure@r13
VERIFIED· install onlyPublisher claims: "The Azure MCP Server, bringing the power of Azure to your agents." Observed in sandbox: no network, touches nothing outside the project, writes no memory.
Registry Docker MCP CatalogPublisher microsoft · publishing for 1195 daysInstalls 77,333Last detonated 3d ago
Coverage
Nothing executable in the bundle ran; the trace covers the install step only.- Tested
- every file read, file written and host contacted by what ran
- Not tested
- use of the skill by an agent
What this means for the label: Verified here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.
Before you give it your token
- It will ask for
GITHUB_TOKENSYSTEM_ACCESSTOKENConfiguration, not credentials: AZURE_MCP_COLLECT_TELEMETRY, BUILD_BUILDID, EVAL_EXPECTED_MATRIX, GITHUB_ACTIONS, GITHUB_API_URL, GITHUB_EVENT_NAME, GITHUB_EVENT_PATH, GITHUB_OUTPUT, GITHUB_REPOSITORY, GITHUB_RUN_ID, GITHUB_SERVER_URL, GITHUB_STEP_SUMMARY, SYSTEM_COLLECTIONURI, SYSTEM_TEAMPROJECTID, TF_BUILD- Where it talks to
- no vendor host named in the codeAlso aka.ms — not the publisher's domain; check what for before connecting.
- What the honeypot saw
- no credential files read · no network
- What we could not test
- use of the skill by an agent
Connect it with a scoped credential, under the guard, and read the third-party hosts first. The code names aka.ms as well as its own vendor. The guard injects GITHUB_TOKEN, SYSTEM_ACCESSTOKEN only into requests to the host you bind (and its subdomains) and refuses the rest.
$vet-skills run --net declared -- docker run -i --rm mcp/azure
Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.
Is azure@r13 safe to install?
KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario; nothing executable in the bundle ran; the trace covers the install step only) on 2026-11-11 and scored it 81/100 (Verified). In what ran, nothing we could detect went wrong: no undeclared network egress, no credential reads, no persistent instruction writes. What it does with a real credential was not observed; the static findings and the publisher carry the rest of the score. Summary: no network, touches nothing outside the project, writes no memory.
Behavior trace
Honeypot run · 0 s · 1 scenarios · 0 deviationst+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only
0.0sprocessno install scripts to re-run
Static findings
HIGH
Collapsed <details> block carrying instructionsservers/Azure.Mcp.Server/README.md:301 · Collapsed <details> block carrying instructions
AST01<summary>GitHub Copilot CLI setup instructions</summary> #### Add Azure MCP Server 1. In a Copilot CLI session, run `/mcp add` to open the MCP server configuratFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.HIGH
Cross-server tool reference.github/agents/onboarding.agent.md:156 · Cross-server tool reference — agent may chain tools across untrusted MCP servers
AST04…xternal MCP Server The Azure MCP Server can act as a **proxy** that aggregates tools from external MCP servers into a single interface. External servers are declared in `servers/Azur…Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.LOW
False authorization claimservers/Fabric.Mcp.Server/README.md:277 · False authorization claim — impersonating privileged role · informational: not an instruction file
AST01* "List my Fabric workspaces where I am an Admin or Member"Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.HIGH
Collapsed <details> block carrying instructionsservers/Azure.Mcp.Server/README.md:750 · Collapsed <details> block carrying instructions
AST01<summary>Additional instructions</summary> **When to use local vs global installation:** - **Local (recommended):** Install in the project directory for projectFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.LOW
False authorization claimservers/Fabric.Mcp.Server/README.md:262 · False authorization claim — impersonating privileged role · informational: not an instruction file
AST01* "List Fabric capacities where I am an administrator or contributor"Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.LOW
Coercive compliance languageservers/Azure.Mcp.Server/README.md:1598 · Coercive compliance language · informational: not an instruction file
AST01…oft to collect data from users of your applications. If you use these features, you must comply with applicable law, including providing appropriate notices to users of your a…Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.MEDIUM
File type combined with upload actioneng/common/scripts/eval/build-eval-summary.ts:398 · File type combined with upload action — agent may exfiltrate local data files
AST07fs.writeFileSync(path.join(options.resultsRoot, "shard-index.json"), JSON.stringify(selection.shardInput, null, 2) + "\n");Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.LOW
Authorization escalation languageservers/Fabric.Mcp.Server/README.md:482 · Authorization escalation language · informational: not an instruction file
AST01…` | Deletes one existing assignment by workspace and assignment UUIDs. Requires Admin access; returns a deletion receipt without identity lookup, cascading removal, retry, …Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.LOW
Authorization escalation languageservers/Fabric.Mcp.Server/README.md:502 · Authorization escalation language · informational: not an instruction file
AST01| `core_update-workspace` | Renames a workspace or updates or clears its description by UUID, leaving omitted properties unchanged. Requires workspace Admin access. |Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.LOW
Authorization escalation languageservers/Fabric.Mcp.Server/README.md:481 · Authorization escalation language · informational: not an instruction file
AST01| `core_delete-workspace` | Deletes one explicitly identified Fabric workspace **and the items under it**. Requires a workspace UUID and workspace Admin access. |Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.MEDIUM
File type combined with upload actioneng/common/scripts/eval/build-eval-summary.ts:415 · File type combined with upload action — agent may exfiltrate local data files
AST07console.log(`##vso[task.uploadsummary]${path.resolve(options.outputPath)}`);Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.LOW
Authorization escalation languagetools/Fabric.Mcp.Tools.Core/tests/Fabric.Mcp.Tools.Core.Tests/README.md:159 · Authorization escalation language · informational: not an instruction file
AST01The caller needs workspace Admin access and delegated Workspace.ReadWrite.All. Fabric protectsFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.LOW
Authorization escalation languageservers/Fabric.Mcp.Server/README.md:362 · Authorization escalation language · informational: not an instruction file
AST01not the principal, group membership, workspace, or all sources of effective access. It requires AdminFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.MEDIUM
npx invocation of non-well-known package.github/agents/onboarding.agent.md:78 · npx invocation of non-well-known package — may execute untrusted code
AST06# 3. Verify everything works (build + npx package smoke test)Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
File type combined with upload actioneng/common/scripts/eval/lib/shard-results.ts:252 · File type combined with upload action — agent may exfiltrate local data files
AST07fs.writeFileSync(path.join(resultsRoot, "shard-index.json"), JSON.stringify(shardInput, null, 2) + "\n");Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.HIGH
Collapsed <details> block carrying instructionsservers/Azure.Mcp.Server/README.md:794 · Collapsed <details> block carrying instructions
AST01<summary>Additional instructions</summary> **When to use uvx vs pipx vs pip:** - **uvx (recommended):** Run directly without installation. Best for MCP server uFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.LOW
Authorization escalation languageservers/Fabric.Mcp.Server/README.md:359 · Authorization escalation language · informational: not an instruction file
AST01assignment with one PATCH. It requires Admin access and an explicit role, without identity translation,Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.LOW
Coercive compliance languageservers/Fabric.Mcp.Server/README.md:2362 · Coercive compliance language · informational: not an instruction file
AST01…oft to collect data from users of your applications. If you use these features, you must comply with applicable law, including providing appropriate notices to users of your a…Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.HIGH
Collapsed <details> block carrying instructionsservers/Azure.Mcp.Server/README.md:814 · Collapsed <details> block carrying instructions
AST01<summary>Docker instructions</summary> #### Create an env file with Azure credentials 1. Create a `.env` file with Azure credentials ([see EnvironmentCredentialFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.Cost to the agent
Instructions loaded
≈42,852 tok
7 files · 80 in bundle
Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.
Known vulnerabilities
Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.